RE: [MLUG] CodeRedII - there's a variant now - READ THIS

["Deterding, Brent D" <EMAIL:PROTECTED>]

If you are a network security guy yes . . . (Hell, I just got hired to
do it)

-----Original Message-----
From: Sam Napier [mailto:EMAIL:PROTECTED]
Sent: Tuesday, August 07, 2001 3:04 AM
To: EMAIL:PROTECTED
Subject: RE: [MLUG] CodeRedII - there's a variant now - READ THIS


      If you think the active directory hit is awesome, you aught to see
what this thing does to an exchange server, OMG. My job as we know it
now rides on the sloffs @ Microjunk patching every variant of this worm
very quickly. 

(Know of any one who is hiring?)

-----Original Message-----
From: EMAIL:PROTECTED
[mailto:EMAIL:PROTECTED] On Behalf Of Deterding, Brent D
Sent: Tuesday, August 07, 2001 10:09 PM
To: MLUG Members (E-mail)
Subject: [MLUG] CodeRedII - there's a variant now - READ THIS

Hey all,
	We're in INFOCON ORANGE now


	Just FYI there's a CodeRedII variant that circumvents the patch.
It's nasty. Just like CRII except it trojans something else and I'm not
sure what. 

	There's no documentation for it yet, but trust me its there. It
hit Asia first but it IS in the US now. 

	You ever see what this thing can do to an Active Directory
server? AAAAAAHHHHHHH my brain hurts. 

	Major ISPs are hurting BAD right now, as are most big companies.


	watch www.incidents.org for more information.


	Anyone want to take bets on the next version?
		I'll bet we'll see selectable targets
		Followed by atttacking the root name servers
					   ^^^^^^^^^^^^^^^^^^^^^ <--
nasty!

-- Brent

PS - I don't mean to sound like a doomsday prophet; but I spent all day
watching several class A's crumble with this. 
--
To manage your subscription, go to
http://mlug.missouri.edu/members/edit.php

Archives are available at http://mlug.missouri.edu/list-archives/

--
To manage your subscription, go to
http://mlug.missouri.edu/members/edit.php

Archives are available at http://mlug.missouri.edu/list-archives/
--
To manage your subscription, go to http://mlug.missouri.edu/members/edit.php

Archives are available at http://mlug.missouri.edu/list-archives/